chore(backend): re-vendor .golangci.yml with gomodguard_v2 (closes #41)

golangci-lint v2.12 deprecates gomodguard, which the org .golangci.yml
reached through "default: all", so every lint run printed a
deprecation warning. backend/.golangci.yml is now the current copy
from sneak/prompts, fetched unedited: gomodguard is disabled and
gomodguard_v2 enabled with the org block list. The new file also
turns depguard on with its test-support rule, which forbids
net/http/httptest outside test code. netwatch has no test-support
packages of its own to add to that rule, so the file is identical to
the canonical one. backend/script/lint checks the new sha256. The
backend raises no findings under the new rules.

Model: opus-5-5

Dockerfile

@@ -72,6 +72,7 @@ RUN addgroup -g 1000 -S netwatch && \
 # conf.d; bin/entrypoint.sh says how.
 RUN rm /etc/nginx/conf.d/default.conf
 COPY nginx.conf /etc/nginx/templates/netwatch.conf.template
+COPY security-headers.conf /etc/nginx/security-headers.conf
 COPY --from=frontend /app/dist /usr/share/nginx/html
 COPY --from=builder /src/netwatch-server /usr/local/bin/netwatch-server
 COPY bin/entrypoint.sh /usr/local/bin/entrypoint.sh

README.md

@@ -188,6 +188,8 @@ only inside the container, on `127.0.0.1:8081`. The image:
   reverse proxies named in `TRUSTED_PROXIES`, and by default from none
 - Sends access logs to stdout
 - Caches static assets with immutable headers
+- Sends the security headers `REPO_POLICIES.md` requires on every response, as
+  `security-headers.conf` sets them, in place of the backend's own
 - Stores reports in `DATA_DIR`, `/data/reports` by default, on the `/data`
   volume. The backend runs as user `netwatch` (uid 1000), so a directory
   bind-mounted at `/data` must be writable by uid 1000

TODO.md

@@ -23,6 +23,20 @@ latest run passes.
 
 # Completed Steps
 
+- 2026-09-29: `backend/.golangci.yml` re-vendored from `sneak/prompts` (issue
+  #41): `gomodguard`, deprecated in golangci-lint v2.12.0, is disabled and its
+  successor `gomodguard_v2` enabled with the org block list, so lint runs print
+  no deprecation warning. The new file also turns `depguard` on with its
+  `test-support` rule, which keeps `net/http/httptest` out of non-test code;
+  netwatch adds no entries of its own to that rule. `backend/script/lint` checks
+  the new sha256
+- 2026-09-29: nginx sends the security headers `REPO_POLICIES.md` requires on
+  every response (issue #18), including errors, `/assets/` and what it passes on
+  from the backend, whose own copies it drops so each header goes out once. They
+  live in `security-headers.conf`, which `nginx.conf` includes. The content
+  security policy allows no inline script or style, so the status dot's grey in
+  `src/main.js` is now a class; `connect-src` is `*` because probed hosts
+  redirect to others, and the browser checks each redirect against it
 - 2026-09-29: the request log is bounded (issue #60): the method, URL, protocol,
   `User-Agent`, `Referer`, request ID (which chi takes from the client's
   `X-Request-Id` header) and client address it writes are each cut to 128 bytes,
@@ -184,9 +198,3 @@ latest run passes.
   (main always green policy)
 - Decide what to do with untracked resume.sh: commit it, gitignore it, or delete
   it
-- Upstream fix needed in `sneak/prompts`: the org-standard `.golangci.yml`
-  enables `gomodguard`, which golangci-lint v2.12.2 reports as deprecated since
-  v2.12.0 and replaced by `gomodguard_v2`, so every backend lint run prints a
-  deprecation warning. The file is standardized and must never be edited in this
-  repo, so nothing can be done here beyond tracking it — tracked at
-  <https://git.eeqj.de/sneak/netwatch/issues/41>

backend/.golangci.yml

@@ -10,14 +10,20 @@ run:
 
 linters:
   default: all
+  enable:
+    # Successor to the deprecated gomodguard. Named explicitly, rather than
+    # left to `default: all`, because it carries the module policy below.
+    - gomodguard_v2
   disable:
     # Genuinely incompatible with project patterns
     - exhaustruct      # Requires all struct fields
-    - depguard         # Dependency allow/block lists
     - godot            # Requires comments to end with periods
-    - wsl              # Deprecated, replaced by wsl_v5
     - wrapcheck        # Too verbose for internal packages
     - varnamelen       # Short names like db, id are idiomatic Go
+    # Deprecated: the warning is attached to the old name, so it is
+    # silenced by disabling that name, not by enabling the successor.
+    - wsl              # Deprecated, replaced by wsl_v5
+    - gomodguard       # Deprecated, replaced by gomodguard_v2
   settings:
     lll:
       line-length: 88
@@ -28,6 +34,64 @@ linters:
       max-complexity: 15
     dupl:
       threshold: 100
+    depguard:
+      # Test-support code must not be compiled into the shipped binary. A
+      # test-support package exists to hand a test privileges the program
+      # itself must never have, so a file that is not a test must not import
+      # one. Test files, and the files inside a package whose directory name
+      # ends in `test`, are where that code belongs, and are exempt.
+      #
+      # The deny list below is the one part of this file a repository is
+      # expected to extend, and the only part it may. depguard matches an
+      # import path against a list of prefixes, so it cannot be told "any path
+      # whose last segment ends in test"; a repository's own test-support
+      # packages have to be named here one at a time, by full import path,
+      # under a module path that differs from repository to repository. Add
+      # them; change nothing else.
+      rules:
+        test-support:
+          list-mode: lax
+          files:
+            - "$all"
+            - "!$test"
+            - "!**/*test/**"
+          deny:
+            - pkg: net/http/httptest
+              desc: >-
+                Test-support code belongs in test files and in packages whose
+                directory name ends in test, not in the shipped binary.
+    # Only decisions already recorded in the Go package defaults are
+    # listed here. Every entry matches the module path exactly.
+    gomodguard_v2:
+      blocked:
+        - module: github.com/rs/zerolog
+          recommendations:
+            - log/slog
+          reason: "Structured logging is stdlib log/slog."
+        # One entry per pre-fork module path, because the later releases
+        # are separate paths. A prefix match would be shorter but would
+        # also reach github.com/go-redis/redismock, the test double for
+        # the successor these entries recommend.
+        - module: github.com/go-redis/redis
+          recommendations:
+            - github.com/redis/go-redis/v9
+          reason: "Pre-fork module; use the maintained go-redis v9."
+        - module: github.com/go-redis/redis/v7
+          recommendations:
+            - github.com/redis/go-redis/v9
+          reason: "Pre-fork module; use the maintained go-redis v9."
+        - module: github.com/go-redis/redis/v8
+          recommendations:
+            - github.com/redis/go-redis/v9
+          reason: "Pre-fork module; use the maintained go-redis v9."
+        - module: github.com/sergi/go-diff
+          recommendations:
+            - github.com/aymanbagabas/go-udiff
+          reason: "No unified diff output; use go-udiff."
+        - module: github.com/hexops/gotextdiff
+          recommendations:
+            - github.com/aymanbagabas/go-udiff
+          reason: "Unmaintained fork; use go-udiff."
 
 issues:
   max-issues-per-linter: 0

backend/README.md

@@ -104,7 +104,9 @@ this server. The image's entrypoint, `bin/entrypoint.sh`, starts the server as
 user `netwatch` (uid 1000) with `BIND_ADDRESS=127.0.0.1` and `PORT=8081`, so
 only nginx reaches it, and with `TRUSTED_PROXIES=127.0.0.1/32`, so it takes the
 client address nginx passes on and no other. `DATA_DIR` is `/data/reports`, on
-the `/data` volume, which `netwatch` owns.
+the `/data` volume, which `netwatch` owns. nginx replaces the security headers
+this server sets with those in the root `security-headers.conf`, so those are
+what clients of the image see.
 
 The container's own `TRUSTED_PROXIES` goes to nginx instead: IP addresses or
 CIDRs, separated by commas, of the reverse proxies in front of the container.

backend/script/lint

@@ -14,7 +14,7 @@ set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
-GOLANGCI_CONFIG_SHA256="021cc83f4e6fc7c31b95b34b846723dfcf20b66b7baeea1dc40406e643346bcb"
+GOLANGCI_CONFIG_SHA256="a79b63a254602a5318db5d0e9a06bc71b84bf0c1d896305229d8bfed1d1b1776"
 
 main() {
     cd "$ROOT"

nginx.conf

@@ -8,6 +8,11 @@ server {
     # Keep the nginx version out of the Server header and error pages.
     server_tokens off;
 
+    # The security headers, on every response. An add_header in a
+    # location drops every add_header from here, so a location with one
+    # of its own includes this file again.
+    include /etc/nginx/security-headers.conf;
+
     root /usr/share/nginx/html;
     index index.html;
 
@@ -32,6 +37,7 @@ server {
     location /assets/ {
         expires 1y;
         add_header Cache-Control "public, immutable";
+        include /etc/nginx/security-headers.conf;
     }
 
     # netwatch-server, the Go backend, runs in the same container and
@@ -45,6 +51,16 @@ server {
     proxy_set_header X-Forwarded-For $remote_addr;
     proxy_set_header X-Forwarded-Proto $scheme;
 
+    # netwatch-server sets the same security headers on its own
+    # responses. Its copies are dropped so that each header goes out
+    # once, as security-headers.conf sets it.
+    proxy_hide_header Strict-Transport-Security;
+    proxy_hide_header Content-Security-Policy;
+    proxy_hide_header X-Frame-Options;
+    proxy_hide_header X-Content-Type-Options;
+    proxy_hide_header Referrer-Policy;
+    proxy_hide_header Permissions-Policy;
+
     location /api/ {
         proxy_pass http://127.0.0.1:8081;
     }

script/frontend-viewport-test

@@ -64,13 +64,15 @@ main() {
     # nginx.conf is a template: the image renders it over its own
     # default.conf, with the same port and limit bin/entrypoint.sh uses.
     # The empty file it includes trusts no proxy, as bin/entrypoint.sh
-    # writes it when TRUSTED_PROXIES is unset.
+    # writes it when TRUSTED_PROXIES is unset. nginx.conf also includes
+    # the security headers, so the page runs under the shipped policy.
     docker run -d --rm --name "$SERVER" \
         --network "$NETWORK" --network-alias netwatch \
         -e PORT=8080 -e NGINX_ENVSUBST_FILTER='^PORT$' \
         -v "$ROOT/dist:/usr/share/nginx/html:ro" \
         -v "$ROOT/nginx.conf:/etc/nginx/templates/default.conf.template:ro" \
         -v /dev/null:/etc/nginx/trusted-proxies.conf:ro \
+        -v "$ROOT/security-headers.conf:/etc/nginx/security-headers.conf:ro" \
         "$SERVER_IMAGE" > /dev/null
 
     # The image's own entrypoint already exposes CDP on 9222 and passes

security-headers.conf

@@ -0,0 +1,24 @@
+# The security headers REPO_POLICIES.md requires on every response.
+# nginx.conf includes this file, which Dockerfile copies to
+# /etc/nginx/security-headers.conf. always sends each header on error
+# responses too.
+
+add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+
+# Scripts and styles load only from the page's own origin. Inline ones
+# are blocked, style attributes in markup included, so style elements
+# through classes or element.style. data: images are for the favicon
+# in index.html. connect-src is * because the browser checks each probe in
+# src/main.js against it, and also every redirect the probe follows,
+# and several of those hosts redirect to others; a list of hosts here
+# would block those probes. It also covers the reports the page sends
+# to its own origin.
+add_header Content-Security-Policy "default-src 'self'; connect-src *; img-src 'self' data:; object-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'" always;
+
+add_header X-Frame-Options DENY always;
+add_header X-Content-Type-Options nosniff always;
+
+# The probed hosts are not told where the page is served from.
+add_header Referrer-Policy no-referrer always;
+
+add_header Permissions-Policy "accelerometer=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), usb=()" always;

src/main.js

@@ -716,7 +716,7 @@ function hostRowHTML(host, index, showPin = true) {
         ${pinBtn}
         <div class="w-[420px] flex-shrink-0 grid grid-cols-[minmax(0,1fr)_auto] items-center">
           <div class="flex items-center gap-2 min-w-[200px]">
-            <div class="w-3 h-3 rounded-full flex-shrink-0" style="background-color: ${latencyHex(null)}"></div>
+            <div class="w-3 h-3 rounded-full flex-shrink-0 bg-[#6b7280]"></div>
             <span class="font-medium text-white truncate">${host.name}</span>
           </div>
           <div class="latency-value text-4xl font-bold tabular-nums text-right mt-3" data-host="${index}">